af8d8233db16b4f3a6adbd7aef5300bde76dda74ccb610f5a1fc3f1dddc82ccb

General

Target

ready.apk
Size

692KB
MD5

5016bd2701cdbe14a39b3a27395c97c4
SHA1

2d996cae86c9a36d7ff4ad75af73bdfc05b10a58
SHA256

af8d8233db16b4f3a6adbd7aef5300bde76dda74ccb610f5a1fc3f1dddc82ccb
SHA512

012ce5e15c8bd9f24c29fff033d8823e2ef511bed238285bbba841d3be16701145c01fddd8ae71217943e2b7a4af35b6e19928e72e077ea093e59a1c78b53311
SSDEEP

12288:cJFRKK4blrTQ9oQhKOUJQSPsKlXEHusT3cgtN0FDb6Rq21pgyBtWDzs:cRQFQYHJQDKREHHT3SFDbGNKhzs

Score

7^/10

collection credential_access defense_evasion discovery evasion persistence

Malware Config

Signatures

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.appser.verapp

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.appser.verapp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.appser.verapp

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.appser.verapp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.appser.verapp

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appser.verapp

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.appser.verapp

com.appser.verapp
1⤵
- Makes use of the framework's Accessibility service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4255

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1629

Prevent Application Removal

Input Injection

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
36B

MD5
ef7483d30f9937599061cf8fddcea864

SHA1
6e31006bbd96ae01f49964c16851be3185ffcf40

SHA256
55106cf8a3fe38e18570e635b3fa4019a563c0921773fcd926e510806cdff3a9

SHA512
43bf4e0d05d4c1bbb86a4605169a2623490481c0a0630c9970f91138174049d800e2a9259b63c610c7983a528cf1dd6e8c98969981e3289e0850ccadb52e74fe

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
24B

MD5
8b7b3f50eed2777d6c50bdb3e883519c

SHA1
f3f04b5679105f5bd0efc3dda76aa29258ac006f

SHA256
3c5f2c9318209bfb1e85b0bc7d92b4c038881913854a4ea1fd7c4fa46cbd0dde

SHA512
037435b68e40006b82c78989d7ed7b4751b7026859f62c0c2ba58957638d75be284509b6fd108557fcf452d5696f8e03e32b520d56b37d8f3416a519b6c0dbc4

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
24B

MD5
2ac244b9b6eaae01972d1c5a23aa6909

SHA1
a91d8bd71990aa82b7bdd073dce972a06714f81a

SHA256
3df2098ad52682321aa7e134d7358fd3bbece7830b6b02db1be19de6b609e289

SHA512
ce061ce6d6f8ba4cc61cbd5e66e981d044905787d91e6ffef4b825bc3968ba4aaec710409471802146e746111cb0f61dcdc0c98d402bedbabdf201fe7aaeb18d

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
24B

MD5
c7c859652eedf38ef39f669f97709f75

SHA1
2adc318b611b21e1ba76e3194111c05995e4ff20

SHA256
bf7e465191433903c9acb6a045ae906de3f3a1a0ecf941797ff94e2d6c2d3bc3

SHA512
9e32d16e10fcb31ed4102fc8d4571a8b565aba69ce380ec722c19ab39d5c643c63a797b31284b17e2033c802cc6ac98725cc22d859f61db1de4ac572568596d5

Download Submit
/storage/emulated/0/Config/sys/apps/log/log-MjAyNS0wMi0xOQ== .txt

Filesize
255B

MD5
58c6f8f7f9b20c11c70bd58f69479496

SHA1
f036775810607ba4fdf863d679ae1b094e64debf

SHA256
e1b811037ba5306457b62c447e25aed37c6a174c73ec2bc10319db81ffd94cc5

SHA512
e8bc06d0bf83b5f90bdf35b1950d81952d36a9dbcae4eb77c89901febfa273a35d88ff51efb162e525c55d78ebb5fbcfc5f4b7f61d533243955ab6ea2525a020

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads